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Abstract 

For a physical layer message aulhentication procedure based on the comparison of channel estimates 
obtained from the received messages, we focus on an outer bound on the type I/II error probability region. 
Channel estimates are modelled as multivariate Gaussian vectors, and we assume that the attacker has 
only some side information on the channel estimate, which he does not know directly. We derive the 
attacking strategy that provides the tightest bound on the error region, given the statistics of the side 
information. This turns out to be a zero mean, circularly symmetric Gaussian density whose correlation 
matrices may be obtained by solving a constrained optimization problem. We propose an iterative 
algorithm for its solution: Starting from the closed form solution of a relaxed problem, we obtain, by 
projection, an initial feasible solution; then, by an iterative procedure, we look for the fixed point solution 
of the problem. Numerical results show that for cases of interest the iterative approach converges, and 
perturbation analysis shows that the found solution is a local minimum. 

Index Terms 

Authentication, Physical layer security, Rayleigh fading channels, Hypothesis testing 

I. Introduction 

Physical layer security provides an effective defense mechanism which is complementary to 
higher layer security techniques. Indeed, it has the potential of resisting the attacks based on 
computational capabilities that may be feasible in the near future, e.g., by quantum computing. 
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Moreover, security implemented at the physical layer is usually based on information theoretic 
arguments. It therefore entails analytically predictable performance irrespective of the attacker 
capabilities. One of the most desirable mechanisms of physical layer security is the authentication 
of the message source. This key task can be conveniently recast into a hypothesis testing problem 
||9l , [fT4ll . namely to decide between hypothesis T-Lq that the message was effectively sent by the 
legitimate source, and hypothesis "Hi that it was forged by the attacker. 

Physical layer authentication has been addressed by considering either device-specific non- 
ideal transmission parameters extracted from the received signal or channel characteristics 
to identify the link between a specific source and the receiver [|5l, [|71, jHl. In this paper we focus 
on the latter case, which finds application in many wideband wireless systems, where even small 
changes in the position of the transmitter have a significant impact on the channel. In particular, 
we consider the approach of [[8l, where the test is performed in two phases. In the first phase, 
the receiver gets an authenticated noisy estimate x of the channel with respect to the legitimate 
transmitter. In the second phase, upon reception of a message, the receiver gets a new estimate 
u of the channel and compares it with x. Then, he must decide whether u is an estimate of the 
legitimate channel or the channel forged by an eavesdropper. 

The performance of a binary hypothesis testing scheme is measured by the probability of 
type I (false alarm), and type II (missed detection) errors. Therefore, theoretical bounds on 
the achievable error probability region are of great importance to establish the effectiveness of 
practical schemes. For instance, S considered the traditional authentication scenario in which 
the legitimate parties can make use of a shared cryptographic key that is kept perfectly secret 
to the attackers. There, an outer bound on the achievable error region was derived, that holds 
irrespectively of the decision rule implemented by the receiver. Then, by fixing the false alarm 
probability, the outer bound is turned into a lower bound on the missed detection probability. An 
analogous approach was used in [|TT| and [fT3l within the different contexts of steganography and 
fingerprinting, respectively. Similarly, in lfT4l . such lower bound is paired with an asymptotic 
upper bound, and both are derived also in the case that the legitimate parties share correlated 
sequences, instead of an identical key. 

In the above cases, since the attacker has no information on the shared sequences, the optimal 
attack strategy with respect to the outer bound is to present forged signals that, albeit independent 
of the legitimate shared key, are generated from the same marginal distribution as the legitimate 
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Fig. 1 : Abstract model for physical layer authentication cast as an hypothesis testing problem with channel estimates 
as the available observations. 



signals. In our framework, on the contrary, the legitimate authentication signal is the actual 
realization of a fading wireless channel. Thus the attacker has some side information given 
by the channel estimates z he performs, which are in general correlated with the legitimate 
channel. We model channel estimates as correlated multivariate Gaussian vectors, which is a 
usual assumption in wireless transmissions, including those using orthogonal frequency division 
multiplexing (OFDM) or multi-antenna (multiple input multiple output, MIMO). 

The contribution of our paper is thus threefold: 1) we derive an outer bound to the error 
probability region, in terms of the attacker strategy; 2) we prove the existence of a strategy v, 
jointly Gaussian with z, that yields the tightest bound, and characterize the covariance through 
the solution of a system of two matrix equations; 3) we give an efficient technique for the 
numerical evaluation of the optimal attack strategy and the corresponding bound. 

The paper is organized as follows. Section [ll] introduces the problem formally, so that the 

we propose 



theoretical results can be derived in Section ^IIl Based on those results, in Section IV 



an efficient algorithm for the numerical evaluation of the optimal attack strategy. Then, in Section 



M we give examples of numerical results, and eventually we draw conclusions in Section VI 



In our notation, if a G and h G are random vectors, Kab denotes the n x m covariance 
matrix of vectors a and b , whereas Kr^-i stands for the (n + m) x (n + m) variance matrix of 
the vector [5]. The symbol A* denotes the complex conjugate transpose of matrix A. 
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II. Problem Statement 



We consider the physical layer channel authentication scheme where agents Alice and Eve 
transmit messages to Bob, and Bob aims at authenticating messages from Alice, i.e., deciding 
whether she sent them or not. The authentication is performed via a two phase procedure, as 
detailed in [H: 

a) First Phase: In the first phase Alice transmits one or more messages, whose authenticity 
is guaranteed by higher layer techniques. Bob gets a noisy estimate x of the channel with respect 
to Alice and replies with acknowledge messages. Moreover, upon Alice and Bob transmissions. 
Eve gets (possibly noisy) estimates of her own channel with respect to both the other agents: 
the set of these two estimates is denoted with z. 

b) Second Phase: In the second phase, either Alice or Eve transmits messages. Bob 
authenticates the received messages by getting a new noisy channel estimate u and comparing 
it with his template x. If this decision process V deems the message as coming from Alice, the 
binary flag b is set to zero, otherwise it is set to one. In this phase, Alice performs transmissions 
in the same fashion of the first phase, while Eve performs a pre-processing of her own messages 
in order to induce an equivalent channel estimate by Bob that is as close as possible to x. 

An abstract representation of the authentication scenario is given in Fig. [T] We assume that 
Eve is able to forge any equivalent channel v to Bob, through a probabilistic strategy, based 
on her observations z, which can be characterized by the conditional distribution p^^^. Although 
constraints on power and channel characteristics may in practice prevent this, the assumption is 
a worst case scenario, which is of interest to derive performance bounds. On the other hand, 
estimates of Alice-Bob channel in both the first and the second phase are not identical, in general, 
due to independent noise that affects both estimates. Let y denote a realization of the random 
channel estimate of the Alice-Bob channel. Given the channel estimate u. Bob decides between 
the two hypotheses 



Ho 



u = y 



message is from Alice , 



(1) 



^1 



u = V 



message was forged. 



(2) 



In Fig. [Tj being in hypothesis I-Lq or 1-Li is obtained by setting 6 = or 1, respectively. Correct 
authentication is achieved when h = h. 
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Recall that all channels are described by zero-mean circular symmetric complex Gaussian 
vectors with correlated entries, as a suitable model for many scenarios (including MIMO/OFDM). 
Moreover, we assume that all transmissions are corrupted by additive white Gaussian noise with 
zero mean. Therefore, also the channel estimates are zero-mean circular symmetric complex 
Gaussian vectors with correlated entries. In particular, x, and y are n-dimensional, complex, 
circular symmetric Gaussian random vectors, z is an m-dimensional, complex, circular symmetric 
Gaussian random vector, while v is an n-dimensional, complex, random vector whose probability 
density is not specified as it will be chosen by the attacker in order to obtain better mimetic 
features. We denote the set of all possible conditional distributions (forging strategies) Pv\zi-\-) 
as 

Q=|g(-|-) : C^xC'^^n,q{b\c)>0,j g(6|c)d6 = l| . (3) 

Performance of the authentication system are assessed by type I error probability a, i.e., the 
probability that Bob discards a message as forged by Eve while it is coming from Alice 

a = P[b = l\no] , (4) 

and the type II error probability /3, i.e., the probability that Bob accepts a message coming from 
Eve as legitimate 

/3 = F[b = 0\ni] . (5) 

The aim of a clever design for the authentication scheme is to make both error probabilities 
a and (3 as small as possible. Since it is trivial to achieve a + (3 = 1 with a random decision 
strategy that outputs b = 1 with probability a, independently of the observation u, we are only 
interested in values of a, /3 in the region 

7^o = : a > 0,/3 > 0,a + /3 < 1} . (6) 

A. Error Region Bounds for a Given Attacking Strategy 

A first bound on the error region for a given attacking strategy can be obtained by applying 
the fundamental data processing inequality for the KuUback-Leibler (KL) divergence [fT2ll to our 
binary hypothesis decision scheme V. In fact, from [fTTTl . ||9l we have[^ 

^ {Pb\n^ 1 1 Pb\n,) < ^ {Pxu\H^ 1 1 Pxu\Ho) ■ (7) 

'Note that the symmetric bound V (^p^-j^^ IIpSiwi) — ^ {Pxu\no \ \Pxu\ni) also holds true (see also fSl). 
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First we observe that = a,p^y^^{0) = 1 — a, and similarly (0) = = l—(3. 

Therefore, introducing the functioii|^ 

/ V) = ^ log ^ + (1 - ^) log ^ , ^ G [0, 1] (8) 
we can rewrite Q as 

a) <V {p^u\ni 1 1 Pxu\no) ■ (9) 

Since the observation z encloses all the information the attacker can exploit in order to deceive 
the receiver, we can assume that the forging strategy v is conditional independent of the secure 
template x, given z. Then the divergence on the right side of (|9]) can be written explicitly for a 
given attacking strategy q{-\-) G Q as 



D{q) = V {p^u\Hi 1 1 Pxu\Ho) = (Pxv 1 1 Pxy) 



log (^j Pxz{a,c)q{b\c)dcj -\ogp^y{a,b) 



Pxz{a,c)q{b\c) dc 
Let /o > be given and set 

7^(/o):={(a,/3)G7^° : /(/3,a)</o}. 
Then (|9]) can be rewritten as 

(a,/3)G7^(D(g)) . 



(10) 
da d6.(ll) 



(12) 



(13) 



B. Error Region Bounds for Any Attacking Strategy 



Each outer bound in (13) is clearly looser than 



where 



nn= []niD{q)) = n{D* 

q&Q 



= inf D(q) 

<76Q 



(14) 



(15) 



^Notice that f{ip, ip) is the KL divergence between two Bemoulh probabihty distributions of parameters ip and 1 — ip, 
respectivley. 
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Note that the region in ([14]) is not strictly speaking an outer bound of the type ([T3|), since 



the infimum ( [15] ) may, in general, not be achievable. In that case, ( [T4[ ) represents a worst case 
performance for the authentication system, over all possible attacking strategies. On the other 



hand, for the attacker, approaching ( [T5[ ) represents the possibility to effectively carry out an 
impersonation attack. 



The main goal of this paper it to evaluate the tightest bound ( ]T4] ). Indeed, we provide an 



attacking strategy achieving ( [T5[ ), under the assumption that the observation z encodes all the 
information about the secure template x the attacker can rely on in order to deceive the receiver. 
We have just shown that this is equivalent to the following constrained optimization problem: 

Problem 1: Given the zero-mean, circular symmetric, jointly Gaussian random vectors x, y, z 
with joint covariance matrix 



K 



K K K 

^^xx ^^xy ^^xz 

K K K 

^^yx ^^yy yz 

K K K 

^^zx ^^zy ^^zz 



(16) 



find a joint probability distribution p-j.^^ £ L^(C^"'^™) such that its marginal p^v minimizes 
V (pxv 1 1 Pxy) under the constraints: 

1. The marginal distribution of x, z (corresponding to Pxvz) is equal to the given distribution p^^- 

2. The random vectors v and x are conditionally independent given z. 

III. Main results 

In this section, we address Problem [T] In particular, we show that the problem is feasible, 
that it admits an optimal solution and that this solution is Gaussian. Finally, we show how to 
reformulate this problem in terms of solutions of two coupled matrix equations. The first issue 
to be considered is the feasibility of Problem [T] namely the existence of a distribution p^vz 
satisfying the constraints and such that V {p^^ \ \ p^y) is finite. 

Lemma 1: Problem [T] is feasible. 

Proof: Let v be an n-dimensional, complex, zero-mean, circular symmetric Gaussian random 
vector (with arbitrary covariance) independent of x and of z. It is immediate to check that the 
corresponding p^.^^^ satisfies the constraints and is such that V (p^v \ \ Pxy) is finite. ■ 

Lemma 2: Let x and z be jointly Gaussian. For any attacking strategy pxv having finite second 
moment and in which v and x are conditionally independent given z, they are also conditionally 
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orthogonal given z, that is 



E [(x - E[a;|2])(t; - ^\v\z\)\ = 0, 

where IE[-|z] stands for the best linear estimator of ■ given z 
Proof: We have 



(17) 



E [{x - E[x\z]){v - E[t;|;z])] = E [E \{x - W^x\z\){v - E[f |^])|^]] 

= E [E [(x - 1 \E{[v -%\v\z\)\z^ 

= E [{E[x\z] - E[x\z]) {E[v\z] - E[v\z])] , 



(18) 
(19) 
(20) 



where ( [T8| ) and ( [T9| ) follow from the Total Expectation Theorem and the definition of conditional 
independence, respectively. Since x and z are jointly Gaussian, we have that E[x|2;] = E[x|2;]. 
Thus, we can conclude that the right-hand side of ( [20| ) is equal to zero. ■ 
In general, conditional independence does not imply conditional orthogonality, although for 
jointly Gaussian variables they are equivalent. However, we have proved that conditional inde- 
pendence of X and v given z implies that x and v are conditionally orthogonal given z, thanks 
to X and z being jointly Gaussian. 



Let us recall the joint covariance matrix (16 1 









K 


K 


K 

^^xz 


K 


X 
V 




K 


K 


K 




_ z . 




K,x 


K 


K,z 



(21) 



Notice that, since the attacker knows the joint probability density Pxyz, the corner elements of 



(21 1 are known. For the sake of simplicity, we introduce the following symbols for the unknown 



blocks of (21): 



X := K, 



Y:=K, 



Z := 



(22) 



Hence, we can write 



K 



Y 



Y* X 



Kz Z* K,, 



(23) 
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Recall that the conditional orthogonality of x and v given z is equivalent to the following 
zero-block pattern in its inverse]^ 

* * 



* * 
* * * 



(24) 



In this way we have expressed the second constraint of Problem [T] in terms of the structure of 
the inverse of the covariance matrix. We can therefore enforce this constraint by resorting to a 
"maximum entropy" completion as described in [i3j, see also ||6l for a more general result and 
Q for an application of this technique. 

Lemma 3: If qc is a circular symmetric Gaussian distribution, then, among all distributions p 
that share the same mean vector yU and covariance matrix K, the one that minimizes (p 1 1 qc) 
is circular symmetric and Gaussian. 

Proof: Let pc be a circular symmetric Gaussian probability density on C" and let p ^ pche 
any density having the same first and second moment as pc- We denote by H(p) the differential 
entropy of the density p, i.e. H{p) := — J p{a) \ogp{a) da. Then (see [fT6l Theorem 2]), we have 
the inequality 

H{p) < H{pg). (25) 
Now let qc be any proper Gaussian density on C". Under the same hypotheses, we have 

log qG{x)p{x)dx = log qG{x)pG{x)dx, (26) 



because logqdx) is a quadratic function of x. In view of (25) and (26), we now have 

p{x) 



KpHqg) 



log 



-p{x)dx 



H{p) — I log qG{x)p{x)dx 



= -H{p) - j log qG{x)pG{x)dx 

> -H{pg) - j logqG{x)pG{x) = ©(pclkc), 



'a proof can be worked out in the same vein of 1151 Section 2]. 
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with equality iff pc is circular symmetric and Gaussian. Thus, if p is the solution of any minimum 
entropy problem with circular symmetric Gaussian prior, p has to be circular symmetric and 
Gaussian. ■ 
Lemma 4: If the second moment of p^v is not finite then V (p^^ \ \Pxy) = co- 

Proof: We assume that V (p^v \ \ Pxy) is finite and show that the second moment of p^v is 
finite. Let us first recall the variational formula for the relative entropy [4, page 68]: 

{PxvWVxy) = ^^V { I f{a)p^y{a)da - log / exp[!f{a)]p^y{a)da [ (27) 

where $ is the set of bounded functions. Observe now that, since p^y is a Gaussian probability 
density, there exists £ > such that 



L ■■= Ep^Jexp[£||a| 



Q2n 



eyip[£\\a\\'^]pxy{a)da 



is finite. Let us now consider the following sequence of bounded functions: 

|2 



e\\a\ 
0, 



, if||a||2</, 
if \\aP > I. 



From (27 1 we get that for all / = 1, 2, 



V{p 

XV 

I I P^y) + log 



e-x.Y>[ipi{a)]p^y{a)da 



> I ipi{a)p^^{a)da, 



or, equivalently, 
1 



{Pxv \\Pxy)+ log 



C2" 



exp[ipi{a)]p.^y{a)da 



> I Pxv{a)da, 



(28) 



(29) 



2n 



< /}. As / — !■ oo, the left-hand side of (29) converges to 



where fi; := {a G C 

^[D {pxv \ \Pxy) + L] while the right hand side converges to the trace of the second moment of 
Px^. Such a trace is therefore finite and thus also the second moment of p^v is finite. ■ 
We are now ready to consider the existence problem. As in many optimization problems this is 
one of the most delicate issue. 

Theorem 1: There exists an optimal solution p*^ of Problem [Tj 

Proof: Let d* be the infimum of V (p^v \ \ Pxy) over p^.^, satisfying the constraints of Problem 
[T| Let j = 1, 2, . . . , be a sequence of probability densities satisfying the constraints of 
Problem [T] and such that the corresponding marginals satisfy 

\iu,V{pi^J\p^y)=d\ 

j-s>oo 
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In view of Lemma |4| we can assume that all pl^^ have finite mean vector fij and covariance 
matrix Kj. Let rrij and Kj be the mean and covariance of i.e. mj are the first 2n components 
of fij and Kj is the 2n x 2n upper- left block of Kj. Now notice that, as j — )• oo, \\Kj\\ and 
||mj|| remain bounded. In fact, in view of Lemma [3| 

' det[K,] 



V (pi, 1 1 p^y) > V {p^J 1 1 p^y) = trace [K-^^ K,] + m^iT"^^^ 



In 



2n, (30) 



det[i^^^jj 

where is the Gaussian distribution having mean vector rrij and covariance matrix Kj. It is 



easy to check that the right-hand side of (30) diverges if at least one of \\Kj\\ and ||mj|| does. 



Hence, both \\Kj\\ and \\mj\\ remain bounded. Thus, also fXj and Kj remain bounded. Therefore, 
there exists a subsequence p^j^^ such that Kj^ and ^j^ converge. Let K* and fi* be their limits and 
let K* and m* be the limits of Kj- and rrij- . Notice now that each density of the corresponding 
sequence p^^^ satisfies the constraints of Problem [1} In fact, the marginal p^z does not change 



and, in view of (24), the second constraint only depends on the variance matrix. Therefore, also 



the Gaussian distribution p^*^, whose mean and variance are K* and p*, satisfies the constraints 
of Problem [1} Let p^* be the corresponding marginal. We have 

= lim V (p^; 1 1 p,y) > lim V (p^J- 1 1 p,y) 



lim trace [Kr^. Kj] + m^K.]^ 
[y\ [y\ 



In 



= trace [KtI^ K* 

= T^{p'^:\\pxy)- 

Thus solves Problem [l] 



Vy\ 



det[ir,J 
det[i^^:i.j 

<let[K''] 



2n 



det[K 



[yVl 



- 2n 



(31) 



Notice that from (31 ) it is immediate to see that the optimal solution not only exists but is 
Gaussian distributed with zero mean. 

Corollary 1: Let x and y be jointly Gaussian. Then the solution of Problem [T] is zero mean 
and Gaussian. 

We are now ready to find the solution of our problem. 
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Theorem 2: The solution of Problem [T] is the zero mean circular symmetric Gaussian density 
whose covariance matrix is 



XX ^^xz-^^ zz ^^xz 

ZK-}K* ZK-^^Z* + CC* Z 



K* 

xz 



(32) 



where Z and C solve 

C* = C*{ZK^}BK-^Z* + CC*)-^A 
^ Z* = KzxK-^K^y + BK-,'Z*{ZK-,'BK-}Z* + CC*)-^A 

with 



(33) 



A := K, 



yy 



K* K~^K 

^^xy-^^xx ^^xyj 



u . i\zz ^^xz-^^xx -^^xz- 



(34) 
(35) 



Proof: We have already shown that the optimal solution is a zero-mean Gaussian distribution 
having covariance matrix of the form 



K 



Kxx ^ -^xz 



Y* X 



Kz Z* Kz 



(36) 



K 



> 



where 

K K 

^^xx ^^xz 

K* K 

^^xz 

is given. Clearly in this way the first constraint of Problem [T] is automatically satisfied for any 
X, y, Z. We now show that the second constraint is equivalent to impose 

Y = K,zK-JZ\ 

Indeed, in view of Lemma [2} x and v are conditional orthogonal given z, so that the inverse of 



K^^z must exhibit the zero-block pattern ( [24] ). Based on this information, we can compute Y as 
a function of Z and X by employing the block-matrix inversion formula: 

Ai B, 



Ml 



Ci D, 



iA^-B^D^'C,) -A^'B^{D,-C^A^'B,] 
-D^'CMi - B^D^^CiY^ (D, - CiA^B,)-' 



(37) 
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We partition K 



as 



K 



(38) 



where 



Y 



X Z 



Therefore, the block in position (1,2) of K^^^ (with respect to the partition (38)) is given by 



-Ar'fiipi - CiA^^Bi) ' = ~K,,-' 



X 


z 






K 












Y 


z* 






K 







Y Kxz 



X - Y*Kxx''Y Z - Y*Kxx'^Kxz 



Z* — KzxK^,^ Y Kzz —■ KzxK^^ Kxz 



~v 

=M2 



In order to impose the zero-block pattern ( [24] ) to the inverse, we make the block in position 
(1, 1) in —A^^Bi{Di — CiA^^Bi) ^ vanish. Note that we need to compute explicitely only the 
elements in the first column block of Af2^. Let 



A2 


B2 




X - 


- Y*Kxx-'Y 


z - 


Y Kxx Kxz 


= M2 


C2 


D2 




Z* 


-^^zx-^^xx ^ 




-^^zx-^^xx -^^xz 





Thus, in view of the matrix inversion lemma, the first column block in M2 ^ is given by 

{A2 - B2D2-'c2y^ 

-D2-^C2{A2 - B2DyC2y^ 
Therefore, orthogonality of x and v given z implies 



= -Kxx 



-1 



Y Kx. 



{A2- B2D2-^C2) ' 



-D2~'C2{A2- B2DyC2) ' 
-Kxx-'Y{A2 - B2D2-'C2y' + Kxx-'KxzD2-'C2{A2 - B2DyC2y' 



Y - KxzD2-'C2, 
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SO that 

I + {Kzz ~ KzxK^^K^z) KzxKxx {Kzz "~ KzxK^^K^z) 



= KxzK}Z\ 

In this way, we have parametrized all the matrices Kv^^ whose inverse has the specified structure. 

V 

. ^ J 

At this point, we could minimize the divergence "^{pxvWVxy) over Z and X. This turns out to be 
an easy problem that can be solved in closed form. This solution, however, is not the solution]^ 
of our original problem since there is yet another (hidden) constraint that we need to impose. 
Namely we have to impose that the matrix 



K 



K 

(KxzK-'Zr 
K* 



KxzK^^Z* Kxz 



(39) 



X Z 

Z* Kz-. 

is a bona fide covariance matrix, i.e. it is positive semidefinite. Since -^j^xj is positive definite, 
this constraint is equivalent to 



X 



{KxzK-}z*y z 







-1 




K 

^^xx 


K 




KxzK^z'Z'' 


K* 

xz 


Kzz 




z* 



> 



which, with simple algebraic manipulations, is seen to be equivalent to 

X - ZK-}Z* > 0. 



(40) 



The positivity constraint is then automatically satisfied if we re-parametrize the unknown matrix 
X in term of a new matrix C in the form 



X = ZK-;z* + CC*. 



(41) 



The optimal solution can be now easily obtained by solving the following unconstrained opti- 
mization problem 

arg min D {pxv \\Pxy)- (42) 



''Here we mention this simplified optimization problem because, as discussed later, it turns out to be very useful as the first 
step of an efficient numerical procedure that computes the solution of our original problem. 
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Since 



Z{KxzK-}y ZK~}Z* + CC* 



K 



[I] 



K K 

K* K 



(43) 



solving ( |42| ) is equivalent to compute 

argmin |- logdet(K^^j {Z,C)K^x^'^) + trace K^x^~'^KxvK^x^ {Z,C) 
We are then led to the formulation of Problem [T] Let 



J(ir^,^ (Z, C)) := - log det(K^,^ (Z, C)K-^l^ ) + trace K~^^^ iT^,^ (Z, C). 

Its first variation is provided by 

D[J{Kx.{Z,C));SKx,{Z,C)] 
= trace + Kxy-^)6Kx^] 



(44) 



(45) 



trace 



trace 



= ;A 

An Ai2 
A21 A22 







Kx.K-}bZ* 



5Z{KxzK;^T SZK-^Z* + ZK^^SZ* + 5CC* + C5C 







K,,.K-}5Z* 



trace 



5Z{KxzK~^Y ^ZKtJZ* + ZK-}bZ* + bCC* + CTC* 
Ai25^(i^..i^-^)* 

* ^^JixzK-}bZ* + A22 + ZK-}bZ* + + CbC*\ 

By the properties of the trace and the Hermitian symmetry, we get that the first variation vanishes 
if and only if 

trace [((ir,,ir;/)*Ai2 + Z*fr;/A22) bZ + C*A225C] = 0. 
This holds for all bZ, 5C if and only if 

(ir,,ir-,i)*Ai2 + i^,-'^*A22 = 

C*A22 = 



(46) 



(47) 



The first equation in ( |47] ) can be simplified so that it reads 

ir,,Ai2 + ^*A22 = 0. 



(48) 
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The matrix inversion lemma allows to compute an explicit expression for matrix A 

Al2 = -K~^K^y{Kyy " K y^R"^ K ^y)"^ + 

A22 = [Kyy - Ky^K-^K^y)-' - [ZK^^^K,^ - K -^^K^^ K ^-,) K^^ Z^ + CC*Y' ■ 
Now, let A := Kyy — Ky^K'^K^y, and B := K^z — KzxK'^K^z- Then we can write 
A12 = -K-^K,yA-' + K-^K,zK:^Z* [ZK-JBK:^Z* + CC*]-' , 

A22 = A-^ - {zk;^bk-^z* + cc*y^ . 

Therefore, after some manipulation, we conclude that the optimum solution is provided by C,Z 
such that 

C* = C*{ZK-^BK-^Z* + CC*)-^A 
Z* = K^^K-jK^y + BK-'Z*iZK;^BK;^'Z* + CC*)-'A 



(49) 



In view of ( [TT] ) and ( [14] ), Theorem |2] provides the tightest bound to the error region ( [T4] ). 
Indeed, let ifj-^j be a shorthand notation for the 2n x 2n upper-left comer of ([32j). Then, D* is 



given by 

D^ = D(p*J|p,,) = - log det(irr.l^F,n)+ trace i^r-rM^rxl - ^r^'l 1- (50) 
Consider the circular symmetric Gaussian density p*^^, with zero mean and variance 



■\ogdet{K^^^K^l^) + trace K^^-^ ^ (^[^] ~ ^[y] 



K 



K^.K-}Z* 



ZK-,'Kl, ZK^^Z* 



CC* 



Kz 



(51) 



Note that it is such that x and v are conditionally independent given z. Then, by marginalizing 
and conditioning, we can obtain an optimum attacking strategy p*|^(-|a) which achieves ([14]). It 
is given by the proper Gaussian density whose mean and variance are defined by 



ZKja 



K 



v\z 



X —K K~^K* 

JV^j, l\.yZ-'-^ zz vz 



CC* 



(52) 
(53) 
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IV. Efficient computation of the tightest bound 

In view of Theorem [2| in order to provide the expression of the optimal solution p%y^, we 
have to compute matrices C, Z which solve the system of nonlinear matrix equations ( |33| ). This 
appears however to be a highly non trivial task. Thus, we propose a two stage algorithm: 
1) Feasible (projected) Solution. To begin with, we deal with an optimization problem which 
can be considered a relaxed version of Problem [T] since no positivity constraints on the 
matrix Kv^i^ are imposed. This task turns out to be much simpler to achieve. Indeed, the 

V 
L 2 J 

solution can be computed in closed form. Then, we project the solution to the relaxed 



problem onto the feasible set, i.e. the set of pairs {X,Z) which make Kv^i^ positive 

V 

definite. 

2) Iterative Algorithm. We use the projection as a starting point for an iterative update 



procedure whose fixed point satisfies ([33]). 
Next we provide some details for each phase. 



Feasible Solution. Minimizing ( [TT] ) with no constraints on the positivity of K 

to solve 
Problem 2: 



is equivalent 



argminJ(ir^,^(Z,X)) := |- log det(ir^,^ (Z,X)K^i^ )+ trace iT^^^^ K^^^ | (54) 



where 



K..K-'Z* 



K 



[y] 



K K 



K* K 



(55) 



Z{K,,K-}Y X 

In the same vein of the proof of Theorem [2} we work out the optimality conditions that X and 
Z have to satisfy, based on the analysis of the first variation Z}[J(fr (Z, X); ]. Some 

easy algebraic calculations lead us to the closed form of an optimal solution {Z,X): 



X = K, 



yy 



K* K 

-^^xy-^^xx 



(56) 



xy 



where " ^ " denotes Moore-Penrose pseudo inverse. 

If the obtained X and Z are such that X — Z K^^ K* > 0, the algorithm terminates. Otherwise, 
a pair {C,Z) is obtained as follows. Let T be a unitary matrix such that := T*{X — 
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ZK^^K*)T = diag((ii, (^2, ... ,dk, 61,82, ■■■ , 6h), where di are positive and in decreasing order, 
and Si are negative or zero. Let := diag((ii, d2, . . . , dk, e, e, . . . , e), where e := (cifc/lOO) > 
is a "small" parameter. Let S' := TS'^T* > and C be such that CC* = S'. 
Iterative Algorithm. We use the pair (C, Z) as a starting point for the iterations 

where 

A := i^,, - K^K-^K^y (58) 
S := ir,, - K^K-^K,,. (59) 



By the the iterative process we aim at finding a fixed point for ([57]), which provides the solution 
of Problem [T] The iterative process can be stopped either after a fixed number of iterations, or 
when the variation of D* over one iteration is smaller than a given percentage. 

V. Numerical results 

A. Uncorrelated Channels 

In order to assess the performance of the proposed algorithm for the computation of the tightest 
bound, we first consider the case where m = n and the covariance matrices are identities, i.e. 



In Cr /„ pin 
^ In In "^In 
^n ' ^n ^n 

This scenario corresponds for example to an OFDM transmission with uncorrelated channel 
frequency response. Beyond being an asymptotic case widely considered in the literature, this 
is also a practical scenario, when a subset of subcarriers with cardinality smaller than the 
number of channel taps is considered, and the channel taps are independent Gaussian variables. 
The parameter p dictates the correlation between channel estimates performed by Eve and the 
legitimate channel. 

First we assess the performance of the iterative algorithm. Fig |2] shows the values of the cost 
of the optimum solution D* as a function of the number of iterations for the iterative algorithm, 
with = m = 64, and various values of p. We observe that the iterative algorithm always 
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5 10 15 20 25 30 

Maximum number of allowed iterations 

Fig. 2: Cost of the solution computed by the iterative algorithm as a function of the maximum 
number of iterations, with n = m = 64, for p = 0.1, 0.3, 0.5 



converges to a fixed point for ( pTj ) and that the convergence to a solution with good accuracy 
takes less than 100 iterations. Thus, in the following we consider this value for the maximum 
number of iterations. 

Fig. [3] shows the bound of the type II {(3) - type I (a) error probability region for various values 
of the correlation parameter p, and for n = m = 64, as obtained from the proposed iterative 
approach. As expected, we observe that for increasing values of p, the region of achievable values 
of a and (3 gets wider. In particular, for the considered scenario, the type II error probability is 
larger than 10"^ already for p = 0.4. 

In Fig. |4] we report the results obtained for both the initial feasible solution (projection of 



the solution of and final solution of the iterative algorithm, as a function of n, for p = 
0.1,0.5,0.7. For the sake of clarity, we also show the cost of the solutions provided by the iterative 
algorithm in Tab. |lj 

We note that the iterative algorithm remarkably lowers the value of the cost function from the 
initial feasible solution, thus motivating its use, although it comes at a cost of more computations. 
Also, as expected, the cost function increases with n. For the considered case of OFDM trans- 
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10' 
10"' 
10"' 

10"' 

10^ 
10"' 
10" 
10"' 




p = C.1 



Growing 
values of p 
from 0.1 to 
0.7 



Fig. 3: Bound of the region type II vs type I (a) error probability for various values of the 



correlation parameter p, with K^^ = Inxn, 



^, and 



10' 




Iterative algorithm, p^0.1 
■ ■ ' Iterative algorithim, p=0.5 
■ ' ■ ' ■ Iterative algorithim, p=0.7 

Projection algoritfim, p=0.1 

' Projection algorithm, p=0.5 

_ , _ , _ pi-ojection algorithm, p=0.7 



32 

Value of N 



Fig. 4: Cost function D* as a function of n for various values of the correlation parameter p, 
with Kxx = Inxn, K^z = Imxm, and Kxz = pinxm- Both projcctiou and iterative algorithms are 
considered. 
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TABLE I: Cost of the solution provided by the iterative solution. 



D* 


n = 2 


n = 4 


n = 8 


n = 16 


n = 32 


n = 64 


P 


= 0.1 


1.6099 


3.2199 


6.4397 


12.8795 


25.7589 


51.5179 


P 


= 0.5 


0.3047 


0.6094 


1.2189 


2.4378 


4.8756 


9.7511 


P 


= 0.7 


0.0005 


0.0011 


0.0021 


0.0042 


0.0085 


0.0169 



mission, this means that more dispersive channels having independent taps provide potentially 
a better authentication system. This phenomenon has been already seen in [[8]|. 

B. Correlated Channels 




8 10 12 14 16 18 20 22 24 26 28 itf 10^ 10* 10^ 10° 1o' 1o' 



(a) Iterative algorithm. (b) Initial feasible solution. 



Fig. 5: CDF of the cost function for two values of n. 



We now consider channels with random correlation. We let m = n and generate Kv^i^ as 

y 

\_z ] 

a realization of a 3n x real Wishart matrix]^ Even in this case we verified that setting the 
maximum number of iteration to 100 is enough for the convergence of the iterative algorithm. 
Fig. [5]a shows the cumulative distribution function (CDF) of D* for two values oi n = m, at the 
convergence of the iterative algorithm. Also in this case we observe that a larger n provides a 

n X n real (resp., complex) Wishart matrix is a random matrix W that can be written as,W = AA* , where A is a n x n 
random matrix with independent identically distributed (iid) real (resp., circularly symmetric complex) Gaussian entries. In our 
case, the entries of A have zero mean and unit variance. 
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24 8 1 6 32 64 1 28 

Value of N 

Fig. 6: Percentage improvement as a function of n. Random correlation matrices and n = m. 
Perturbation analysis results are included. 



larger value of D*. We also report in Fig. [5}b the CDF for the initial feasible solution obtained 
by projection. 

For the random correlation case, Tab. [Il] shows the probability that the closed form solution 



of the relaxed problem (56) satisfies the positivity constraint, as a function of n. 



TABLE II: Probability that (56) is feasible, as a function of n 



n 


2 


4 8 


16 


32 


64 


p[%] 


43 


10 












Note that as n increases this probability goes fast to zero, thus making the projection step 
necessary to obtain an initial feasible solution for the iterative algorithm. 



In order to compare the iterative solution to the one provided by ( [56] ), which may not fulfill 
the positivity contraints on the joint covariance matrix. Fig. [6] shows the percentage increase of 
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the cost ( |45| ) defined as 

T] := 100 X 



T* 

J* 



(60) 



where J*^^^ is the cost of the solution provided by the iterative algorithm, whereas J*^ is the cost 



of the one computed in closed form through (56). The analysing of the increment with regard to 



J* is convenient because D*f can vanish. Indeed, recall that, if Kv^i is a n x n matrix, it holds 

ly\ 

that D* = J* — 2n. We note that the increase is in the range of 20% to 30% for the considered 
scenario. Moreover, it is diminishing as n increases. This seems to suggest that, for growing 



values of n, the solution computed by means of < p6j corresponds to a matrix of the form ( |39| ) 
which gets closer to the cone of positive definite matrices of size (2n + m). 

We also provide results for the perturbation analysis. In particular, we evaluate the effects of 
small perturbations of Z and C generated as Gaussian random variables with norm 0.01||Z|| 
and 0.01||C||, respectively. Fig. [6] reports the maximum cost function achieved for all perturbed 
values, showing that it provides negligible improvement with respect to the solution of the 
iterative approach. This supports the conclusion that the iterative approach reaches a minimum 
point for J(_ft'|-^j (Z, C)). We also applied the iterative algorithm starting from the perturbed 
solutions which led to cost improvements. Results, not reported here, show that this procedure 
achieves very small improvements with an increase of the cost function of 0.01% . 

VI. Conclusions 

We have considered the problem of deriving a universal performance bound, for a message 
source authentication scheme based on channel estimates in a wireless fading scenario, where 
an attacker may have correlated observations available. We have formulated an outer bound to 
the region of achievable false alarm and missed detection probabilities, which is universal across 
all possible decision rules by the receiver. 

Under the assumption that the channels are represented by multivariate complex Gaussian 
variables, we have proved that the tightest bound corresponds to a forging strategy that produces 
a zero mean signal that is jointly Gaussian with the attacker observations. Furthermore, we have 
derived a characterization of their joint covariance matrix through the solution of a system of two 
nonlinear matrix equations. Based upon this characterization, we have also devised an efficient 
iterative algorithm for its computation: The solution to the matricial system appears as fixed 
point of the iteration. 
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From numerical results, we conclude that the proposed iterative approach for the best attacking 
strategy always converges. Moreover, from the perturbation analysis, we deduce that the limit 

point is a local minimum. We have therefore provided an effective method for the attacking 
strategy that yields the tightest bound on the error region of the message authentication procedure. 
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